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The Director of Central Intelligence 

Washington, D C. 20505 


BihfMy 

Wi 


Resource Management Staff 


MEMORANDUM FOR: 
VIA: 

FROM: 

SUBJECT: 

REFERENCE: 


IHC/MM 80-2^08 
26 March >380 


Director of Central Intelligence , ^ 

Deputy to the DCI for Resource Management * ' J 



nrector, information Resources Office 
Project SAFE 

A. Your memo of 21 March, Subject: Concern 
Regarding SAFE (Tab A) 


B. Memo from 

to DCI dta jl« Mar 
Regarding SAFE (Tab B) 


Chairman, STAP 

ubject: Questions 


1. I appreciate the opportunity to comment on the issues 
raised by the STAP Panel in connection with the SAFE Project. As 
background to our comments, I should point out that last year, 
after discussions between the D/DCI/RM, the DDCI, and DDA, it was 
determined that the focus of our interest in SAFE was to be "the 
areas of resource allocation and the relationship of SAFE to other 
programs on a Communi ty -wi de basis."* Although we have continued 
to review the development of Project SAFE, our primary attention 
has been in accordance with the above quoted limitations. Conse- 
quently, we are not prepared to comment, except in general terms, 
on many of the concerns raised in the referenced STAP memorandum. 

2. Of the four principal concerns listed in your memo of 
March 21st, only one falls within the scope of IRO's responsi- 
bility as set forth in paragraph 1 above, namely: 

"What actions are underway to ensure that the Intelli- 
gence Community has access to CIA SAFE and that CIA SAFE 
has access to DIA SAFE as well as such systems as COINS 
and SOLIS?" 


*Memo from DDCI to D/DCI/RM dated 16 March 1979, Subject: 
SAFE 


Proj ect 


Approved For Rele^ |gf-g^4-00933R0005001 20023-1 




CIA INTERNAL USE ONLY 

Approved Foft£elease 2001/09/03 : CIA-RDP84-00933SW005001 20023-1 

3. It is appropriate that your concerns along these lines 
be addressed because: 

o At the DCI's semiannual review in May 1979, it was 
stated that a direct physical link between the DIA 
and CIA systems would be provided. 

o Our review of the current version of the System 
Requirements Specifications indicates that such a 
communications connection between CIA and DIA SAFE 
systems is not included in the specifications. 

o I have discussed this deficiency to the attention of 
the SAFE Project Manager and he states that such a 
requirement will be added by amendment; that, 
although this has not yet been accomplished, such an 
amendment will be prepared in the near future. 

4. We believe that it is crucial to the ultimate development 
of the types of intercommunication which are set out in your 
subject memorandum that this requirement be now formalized in the 
SAFE documentation since, if properly specified, it will provide 
the technical capability to enable: 

o CIA analysts to access DIA files. 

o CIA analysts to access other Community files 
through the DIA SAFE interface with the COINS 
network which is included in the current 
requirements documents. 

o DIA analysts to access CIA SAFE files. 

o Analyst to analyst communications between DIA 
and CIA analysts. 

o The capability to permit other Intelligence 

Community components to access CIA SAFE facilities 
by going through the DIA interfaces with the COINS 
or AUTODIN networks. 

5. It should be noted that the provision of the physical 
links and the technical capabilities to accomplish the above 
listed functions will not, in and of itself, result in the 
implementation of any of these functions. None of the SAFE 
documentation, either emanating from DIA or CIA, calls for these 
functions to be provided. Indeed, the original CIA SAFE docu- 
mentation specifically provides that the CIA SAFE system will be a 
closed system accessible only by CIA personnel. The position has 
been taken by some that CIA has no validated requirement for 
access to any non-CIA system, including DIA SAFE. The results of 
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the IHC -sponsored Analyst Support Study indicate that this is 
probably not the case. Nearly half of the CIA analysts 
interviewed said they regularly access outside data bases such as 
SOLIS, the COINS files, CIRC II, and the NPIC data system. 
Furthermore, analyst-to-analyst communication across agency lines 
was ranked the second most important source of information by CIA 
analysts and the most important source by DIA analysts. As 
automated systems develop and improve and analysts become 
increasingly confident in their use of and reliance upon direct 
access to automated systems, requirements for and the value of 
access to external systems should increase still further. 

6. The management of the Consolidated SAFE Project Office is 
working under a handicap in this area. There has been, to our 
knowledge, no extensive formal review or update of CIA's 
functional requirements on the user side since the decision was 
made to combine the two programs. Without any formal statement of 
requirements from the CIA analytical community (primarily NFAC) 
which the system is designed to support, it is difficult for those 
charged with designing and implementing the system to anticipate 
what those needs may be. Therefore, we suggest that either you or 
some other appropriate authority should give to the SAFE Project 
Office some appropriate guidance which addresses these areas of 
concern . 

7. We would call to your attention the fact that providing 
any access to the CIA system from DIA and more especially from 
elements of the Intelligence Community outside of DIA raises 
serious security issues. The resolution of these issues will 
probably require action on your part to modify the present 

i nterpretation of existing security policies, or in some cases 
amendments thereto. If you should decide that the combined SAFE 
systems should provide the types of intercommunication and outside 
access which are outlined in your areas of concern, then someone 
(possibly the Computer Security Subcommittee of the DCI Security 
Committee) should probably be tasked with the responsibility of 
defining the security issues, suggesting possible solutions, and 
performing appropriate risk analyses so that they may be submitted 
to you for resolution. If this is undertaken, IRO should probably 
be involved in some way since decisions on these issues will 
undoubtedly have major long-term effects on the feasibility of 
improving the interagency exchange of information and could also 
have a substantial impact on the resources which will be needed to 
satisfy Community ADP requirements. 

8. General comments on other concerns expressed by you based 
upon our limited perspective are: 


3 
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JJ ^ informed that HBBMof OCR is coordinating 
the CIA user interface with the CSPO; that he is 
completely aware of the status of the project and 
consults regularly with the CSPO. 


o In the development of a project such as SAFE, it is 
extremely important that a well defined single point 
of contact between the users and developers be 
established and maintained. Otherwise, the system 
developers will be faced with conflicting statements 
of requi rements . 


1 the established lines of communications 
wnh the users are not adequate, perhaps the reason 
is attributable to a lack of an effective framework 
within NFAC to provide a continuing review of SAFE 

develops. If this is the case, we are not aware 


o We see no evidence that "major portions of the 

proposed operational capabilities are unspecified." 

It is, however, probably true that NFAC should direct 
more attention to the general issue of what its 
requirements for open source material are and how 
these should be met, either through SAFE or other 
means . 


The decision. to place SAFE on a design-to-cost basis 
necessarily implied some scaling down of the oriqinal 
requirements for the initial version. In consonance 
with this, NFAC did review and set priorities on the 
original SAFE requi rements . 


o It is our assessment that the CSPO is proceeding with 
development so that NFAC 1 s highest priorities will be 
met first and the design will accommodate the later 
addition of those functions which now enjoy a lesser 
priority. J 


o If some of the capabilities which this approach will 
require to be deferred are considered to be important 
enough to warrant it, NFAC should develop a justifi- 
cation for their inclusion in the initial version of 
SAFE and the issue should be addressed during program 


9 

you of 
which 


. In conclusion, I would take this opportunity to inform 
two initiatives we are taking in conjunction with the IHC 
may have an impact on the future development of SAFE. 
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o The development of a user language for SAFE will 
result in a common user language for DIA & CIA. 

We are exploring the possibility that this could 
become the initial step for developing user language 
standards for use throughout the Community. This will 
require the cooperation of the SAFE Project Office 
if it is to succeed. 

o We expect the IHC to recommend the development 
of a distributed system of bibliographic informa- 
tion storage and retrieval systems. If this is 
to be done, the facilities of both the DIA & CIA 
SAFE systems in this area will have to function 
as part of an overall Community system. If this 
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Project SAFE 


Ion: 

- Adse 

- DDC I 

- DDA 

- DD/NFAC 

- D/ODP 

- D/CSPO 

- Executive Registry 
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21 March 1980 


MEMORANDUM FOR: Deputy Director for National Foreign Assessment 
Deputy Director for Administration 
Director of Data Processing 

FROM: Director of Central Intelligence 

SU3JECT: Concerns Regarding SAFE 


1. One of the subjects addressed at the recent Science and 
Technology Advisory Panel (STAP) meeting was the SAFE system and 
its implementation. Several concerns were expressed at the meeting 
regarding SAFE, i ncl uding" the fact that there are no plans at present 
to connect CIA and DIA SAFE systems so that they. are mutually accessible. 
I share several of the concerns expressed by the Science and Technology 
Advisory Panel, and accordingly would like to meet with you to address 
several of the issues that were raised by the Panel. I attach for your 
information and response a list of questions and concerns prepared by. 
the STAP relating to SAFE. While I would appreciate your being prepared 
to address all of these questions at our meeting, I- personally am 
especially concerned about the following: 

— What actions are under way to' ensure that the Intelligence 
Community has access to CIA SAFE and that CIA SAFE has access to 
DIA SAFE as well as such systems as COINS and SOLIS? 

-- How will SAFE deal with open source material? 

— As described in some detail on page 3 of the STAP paper, 
what actions are being taken to identify the real needs of the 
SAFE user community 'and will they be satisfied by the system? 

— How can CIA make a reasonable evaluation of the current 
status of SAFE with major portions of the proposed operational 
capabilities either unspecified or not communicated to the 
Agency? 
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2. I will schedule a meeting to discuss these issues toward the 
end of next week. In the meantime, I would appreciate your responding 
to all of the questions in the attached paper and providing such response: 


$TATINTL 




STANS FI ELD TURNER 


Attachment a/s 


cc: DDCI 
DDS&T 
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1 8 MAR 1980 


MEMORANDUM FOR: Director of Central Intelligence 

Deputy Director of Central Intelligence 


FROM: 


STAP Chairman 


SUBJECT: 


Questions Regarding SAFE 


1. In response to your request of March 14, 19S0, 
for comments on the current status of SAFE, I attach a 
list of eight questions and brief comments that STAP 
believes should be addressed. 

..2. STAP is continuing its analysis of the SAFE 
problem and will prepare an options paper within the next 
two weeks for your consideration. 


h 

Attachments: ^ 

As Stated 


STATINTL 
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1.0 What steps are being taken to ensure that the Agency, 
rather than the contractor is in control of the technical 
aspects of the design of the system? 

The geographic remoteness of the contractor, and the 
lack of continuing contractor-user interaction can lead to 
a situation in which the builder of the system also becomes 
the architect. The absence of reciprocal technical 
representation, like resident engineers, delays every 
routine decision and makes larger ones unresponsive to.' 
Agency/community needs or technological constraints. Strong 
Agency technical management is absolutely essential if the 
system is to satisfy real and evolving agency needs and if 
it is to be integrated with other Agency and community 
resources . 


2.0 How is SAFE management ensuring that a final working 
system has been developed from the continuing evolution of 
an operationally valid pilot system? How has SAFE taken 
advantage of the experience of similar, very large systems 
in their: 

1) system architecture, 

2) communication and control, and 

3) changing performance requirements? 

How is SAFE management ensuring that the system will: 

1) make available data on operation and usage of the 
pilot system to guide development; 

2) be able to modify both system functions and 
interaction capabilities so as to meet changing and evolving 
requirements ; and 

3) be able to add new functions and interactions so as 
to meet new requirements? 

Relevant Experience — It is well agreed that ah 
information handling system cannot be achieved by a simple. 
Design-Build-Use cycle, no matter how brillant the design 
or faithful the building. Consider three (out of many) 
currently operating very large nets with requirements at 
least comparable in size and complexity with the Agency/ 
community's: 

1) the ARPA net, 

2) the airlines reservation system, and 

3) the IBM in-house computing net. 
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All of these systems evolved - that is, they started 
as soon as possible with operating pilot systems, so that 
there was always an operational ■ ■ evaluation of effectiveness. 
Furthermore, in each case, a primary purpose of the original 
plans was drastically altered as experience was gained. Even 
so, developments in concept, hardware, software, and practice 
are continuing now in greater volume than ever. 


2.1 The ARPA Met 

The ARPA net was originally conceived by 
at the ARPA IPO (Information Processing Office) as a means 
of netting research computers in order to do distributed 
computing. The message facility was then a minor . function. 

As message usage rose, packet switching became a powerful 
tool with wide application elsewhere in the technology. The 
separate centers in the ARPA net have much independence, 
subject to some fairly strict requirements for communications 
protocols and access. This allows competitive development 
and a common evaluation of new technological developments — 
e.g., the intelligent terminal is being subjected to widespread 
experimentation and development. 


2.2 Airlines Reservation System 

The first automated electronic airfare reservations and 
ticketing systems were disasters - e.g., SABER, the 
American Airlines/IBM effort was predesigned and built to 
an apparently reasonable set of specifications that turned 
out not at all to match the operational needs. The first 
successful ones were ad hoc temporary devices (e.g. , UNITED) 
that worked just well enough to be improved. 

Note that the requirement for fast and accurate inter- 
line communications, backed up by automatic commitments* for 
seats and equipment was a much later development; it is,. however, 
by now one of the most valuable and cost-effective facilities. 


2.3 The IBM In-House Computing Net 

Virtually all the on-line . computers at IBM company 
installations world-wide are netted together by communication 


- 2 - 
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f acilities , making them, we believe 
the world. Admirable new functions 
systems are: 


the largest net in 
exhibited by their 


1) a modifiable 

2) a consistent 
translation scheme. 


macro command language, 
speedy and flexible data 


transmission/ 


3.0 The SAFE user community consists of Intelligence.'' 

ormnunity analysts . covering the full spectrum of research 
into foreign political, military, economic, scientific 
and tecnnological activity. Their effective 


use o: 


thi 


system and, ultimately, the quality of intelligence thev 

^d d -ati5??ei°t w £® ther their real needs can be identified 
and satisfied by the system. To that end, what actions 
will be taken to ensure that: 

1) all elements of the intended user community 
are actually involved in the system's continuing development, 

are idintified? adGSt ° f th ® present analytical requirements 

.3) these present requirements can be validated bv a 
consistent method, J 

4) the validated present requirements will be met, 

o) modifications and new requirements can be acceoted 
as they are identified, 

, . ^ aP1 an ^lytical users will acquire the necessary 
skiHs and familiarization with SAFE on an interim basis so 

hey are ready to begin broad utilization when system IOC is 
rscicriccl, 

* » 

• • 

7) this interim SAFu test— phase acquires continuing- 
comprehensive experimental data on user experience with the 
system, and 

8) the acquired ^data on user experience is actually 
utilized in the architecture and development of the system? 


-3- 
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4.0 How can the Agency make a reasonable evaluation of the 
current status of _ SAFE with major portions of. the proposed 
operational capabilities either unspecified or un communicated 
to the Agency? For example, 

1) the user command language and its parsing, 

2) the user programming languages, 

3) the user editing languages, and 

. procedures for backup, including regeneration 'of 
derived files lost in crashes. 

Note the above have to be prototypes capable of continuing 
responsive evolution, rather than final imposed prescriptions. 


5.0 What actions are under way to insure that the Intelligence 
Community has access to CIA SAFE and that CIA SAFE has access 
to DIA SAFE as well as such systems as COINS and SOLIS? 

The absence of appropriate linkages with other IC systems 
makes it highly probable that duplicate facilities and files 
will be acquired and constructed with higher costs and lessened 
capability ior the total IC system. Provisions for such 
linkages should be built into SAFE from the start, otherwise 
it will be difficult if not impossible to backfit these 
linkages. 

STATSPEC 


6.0 How will SAFE deal with open source material? Will HH 
material, either finished publications or field reportinc^^^ 
be made available to the analyst through SAFE? How v/ill SAFE 
deal with current newspaper and journal entries? 

Several of the offices that will use SAFE, in particular 
OPA and OSWR, make extensive use of open source material. 
Their analytical efforts will be seriously hampered if * their 
files do not include open source materials . 


7.0 What steps are being taken to ensure that SAFE will be 
designed to allow collaborative usage? 

Examination of other similar systems, such as Stanford 
University's SUMEX system or the internal IBM system, shows 
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that user-to-user interactions comprise a significant 
fraction of the total use of these systems and greatly 
enhance the overall analytical capability of its users. 

8.0 What steps are under way to ensure that in the 
procurement of major hardware items, these items will be 
compatible with existing Agency systems? 

The Agency has made very subs tantial investment in 
ADP equipment that currently serves a wide variety of 
users. This investment should be capitalized on in order 
to enhance the future capabilities and particularly the 
flexibility of SAFE. If the interoperability of SAFE' and 
existing ODP hardware is. going to be dependent on softwar 
then provisions should be made: 

1) for the development of the needed software since 
it will be a major undertaking; and 

2) for the establishment of evolving standards and 
protocols for interconnection. 
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